Configure standard logging (v2)

Use the CloudFront console to create a new distribution or update an existing one.

Under the Standard logging section, for Log delivery, choose On.

(Optional) For Cookie logging, specify if you want to include cookies in your logs.

For the Deliver to section, specify the service to receive your logs:

For the Destination, select the resource for your service. If you haven’t already created your resource, you can choose Create or see the following documentation.

For Additional settings – optional, you can specify the following options:

1. For Field selection, select the log field names that you want to deliver to your destination. You can select access log fields and a subset of real-time log fields.

2. (Amazon S3 only) For Partitioning, specify the path to partition your log file data.

3. (Amazon S3 only) For Hive-compatible file format, you can select the checkbox to use Hive-compatible S3 paths. This helps simplify loading new data into your Hive-compatible tools.

4. For Output format, specify your preferred format.

   Note

   If you choose Parquet, this option incurs CloudWatch charges for converting your access logs to Apache Parquet. For more information, see the Vended Logs section for CloudWatch pricing.

5. For Field delimiter, specify how to separate log fields.

Complete the steps to update or create your distribution.

To add another destination, choose Add another destination and repeat steps 4 – 7.

From the Logs page, verify that the standard logs status is Enabled next to the distribution.

For more information about the standard logging delivery and log fields, see the Standard logging reference.

After you a create a distribution, get the Amazon Resource Name (ARN).

You can find the ARN from the Distribution page in the CloudFront console or you can use the GetDistribution API operation. A distribution ARN follows the format: arn:aws:cloudfront::123456789012:distribution/d111111abcdef8

Next, use the CloudWatch PutDeliverySource API operation to create a delivery source for the distribution.

1. Enter a name for the delivery source.

2. Pass the resourceArn of the distribution.

3. For logType, specify ACCESS_LOGS as the type of logs that are collected.

4. Example AWS CLI put-delivery-source command

   The following is an example of configuring a delivery source for a distribution.

   aws logs put-delivery-source --name S3-delivery --resource-arn arn:aws:cloudfront::123456789012:distribution/d111111abcdef8 --log-type ACCESS_LOGS

   Output

   {
    "deliverySource": {
    "name": "S3-delivery",
    "arn": "arn:aws:logs:us-east-1:123456789012:delivery-source:S3-delivery",
    "resourceArns": [
    "arn:aws:cloudfront::123456789012:distribution/d111111abcdef8"
    ],
    "service": "cloudfront",
    "logType": "ACCESS_LOGS"
    }
   } 

Use the PutDeliveryDestination API operation to configure where to store your logs.

1. For destinationResourceArn, specify the ARN of the destination. This can be a CloudWatch Logs log group, a Firehose delivery stream, or an Amazon S3 bucket.

2. For outputFormat, specify the output format for your logs.

aws logs put-delivery-destination --name S3-destination --delivery-destination-configuration destinationResourceArn=arn:aws:s3:::amzn-s3-demo-bucket

{
    "name": "S3-destination",
    "arn": "arn:aws:logs:us-east-1:123456789012:delivery-destination:cf-dest",
    "deliveryDestinationType": "S3",
    "deliveryDestinationConfiguration": {
        "destinationResourceArn": "arn:aws:s3:::amzn-s3-demo-bucket"
    }
}

Use the CreateDelivery API operation to link the delivery source to the destination that you created in the previous steps. This API operation associates the delivery source with the end destination.

1. For deliverySourceName, specify the source name.

2. For deliveryDestinationArn, specify the ARN for the delivery destination.

3. For fieldDelimiter, specify the string to separate each log field.

4. For recordFields, specify the log fields that you want.

5. If you’re using S3, specify whether to use enableHiveCompatiblePath and suffixPath.

aws logs create-delivery --delivery-source-name cf-delivery --delivery-destination-arn arn:aws:logs:us-east-1:123456789012:delivery-destination:cf-dest

{
    "id": "abcNegnBoTR123",
    "arn": "arn:aws:logs:us-east-1:123456789012:delivery:abcNegnBoTR123",
    "deliverySourceName": "cf-delivery",
    "deliveryDestinationArn": "arn:aws:logs:us-east-1:123456789012:delivery-destination:cf-dest",
    "deliveryDestinationType": "S3",
    "recordFields": [
        "date",
        "time",
        "x-edge-location",
        "sc-bytes",
        "c-ip",
        "cs-method",
        "cs(Host)",
        "cs-uri-stem",
        "sc-status",
        "cs(Referer)",
        "cs(User-Agent)",
        "cs-uri-query",
        "cs(Cookie)",
        "x-edge-result-type",
        "x-edge-request-id",
        "x-host-header",
        "cs-protocol",
        "cs-bytes",
        "time-taken",
        "x-forwarded-for",
        "ssl-protocol",
        "ssl-cipher",
        "x-edge-response-result-type",
        "cs-protocol-version",
        "fle-status",
        "fle-encrypted-fields",
        "c-port",
        "time-to-first-byte",
        "x-edge-detailed-result-type",
        "sc-content-type",
        "sc-content-len",
        "sc-range-start",
        "sc-range-end"
    ],
     "fieldDelimiter": ""
}

From the CloudFront console, on the Logs page, verify that the standard logs status is Enabled next to the distribution.

For more information about the standard logging delivery and log fields, see the Standard logging reference.